| Jeongik Cha | 7e7f19d | 2024-10-31 20:50:24 +0900 | [diff] [blame] | 1 | diff --git a/lib/tls/mbedtls/mbedtls-server.c b/lib/tls/mbedtls/mbedtls-server.c |
| 2 | index efd7fc8b..ca5ebc15 100644 |
| 3 | --- a/lib/tls/mbedtls/mbedtls-server.c |
| 4 | +++ b/lib/tls/mbedtls/mbedtls-server.c |
| 5 | @@ -39,7 +39,7 @@ lws_tls_server_client_cert_verify_config(struct lws_vhost *vh) |
| 6 | } |
| 7 | |
| 8 | if (!lws_check_opt(vh->options, LWS_SERVER_OPTION_PEER_CERT_NOT_REQUIRED)) |
| 9 | - verify_options = SSL_VERIFY_FAIL_IF_NO_PEER_CERT; |
| 10 | + verify_options |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT; |
| 11 | |
| 12 | lwsl_notice("%s: vh %s requires client cert %d\n", __func__, vh->name, |
| 13 | verify_options); |
| 14 | diff --git a/lib/tls/mbedtls/wrapper/platform/ssl_pm.c b/lib/tls/mbedtls/wrapper/platform/ssl_pm.c |
| 15 | index 3879e977..e47d4c13 100755 |
| 16 | --- a/lib/tls/mbedtls/wrapper/platform/ssl_pm.c |
| 17 | +++ b/lib/tls/mbedtls/wrapper/platform/ssl_pm.c |
| 18 | @@ -255,9 +255,9 @@ static int ssl_pm_reload_crt(SSL *ssl) |
| 19 | struct pkey_pm *pkey_pm = (struct pkey_pm *)ssl->cert->pkey->pkey_pm; |
| 20 | struct x509_pm *crt_pm = (struct x509_pm *)ssl->cert->x509->x509_pm; |
| 21 | |
| 22 | - if (ssl->verify_mode == SSL_VERIFY_PEER) |
| 23 | + if ((ssl->verify_mode & SSL_VERIFY_PEER) > 0) |
| 24 | mode = MBEDTLS_SSL_VERIFY_REQUIRED; |
| 25 | - else if (ssl->verify_mode == SSL_VERIFY_FAIL_IF_NO_PEER_CERT) |
| 26 | + else if ((ssl->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) > 0) |
| 27 | mode = MBEDTLS_SSL_VERIFY_OPTIONAL; |
| 28 | else if (ssl->verify_mode == SSL_VERIFY_CLIENT_ONCE) |
| 29 | mode = MBEDTLS_SSL_VERIFY_UNSET; |
| 30 | @@ -980,9 +980,9 @@ void SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx) |
| 31 | |
| 32 | #if defined(LWS_HAVE_mbedtls_ssl_set_hs_authmode) |
| 33 | |
| 34 | - if (ctx->verify_mode == SSL_VERIFY_PEER) |
| 35 | + if ((ctx->verify_mode & SSL_VERIFY_PEER) > 0) |
| 36 | mode = MBEDTLS_SSL_VERIFY_REQUIRED; |
| 37 | - else if (ctx->verify_mode == SSL_VERIFY_FAIL_IF_NO_PEER_CERT) |
| 38 | + else if ((ctx->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) > 0) |
| 39 | mode = MBEDTLS_SSL_VERIFY_REQUIRED; |
| 40 | else if (ctx->verify_mode == SSL_VERIFY_CLIENT_ONCE) |
| 41 | mode = MBEDTLS_SSL_VERIFY_UNSET; |